The whole BRUTE-AI family in one page — the self-prompting ChatCompletions harness, the Hugging Face Inference harness, the retro terminal ML page and the reverse-proxy pitch. Four Spaces are now one, and this page runs entirely in your browser: no server, no CPU spent on the host.
The original page was a single client-side chat loop: it POSTs to a
user-supplied endpoint with a user-supplied API key, streams the reply into a
terminal, and keeps re-prompting itself up to MAX_RESPONSES = 250. The task it
is given is a JavaScript-injection challenge against its own display.
Protocol. Every turn sends
[INST] : {message} [/INST] LAST AI RESPONSE: {terminal}. If a reply contains
[EXEC]…[/EXEC], the harness injects that code with
eval()-style script insertion. If the injection text appears back in the
terminal, it was not executed — that echo is the feedback signal to try another
method.
fetch(..., {mode: "no-cors"}), so the browser could send the request but
could not read the response — the loop was blind to anything a real cross-origin LLM
endpoint returned. Reading a reply requires a same-origin relay: a small server that forwards
your request and returns the body. That relay is the CPU suite —
brute-suite
— and this static page keeps the family readable without one.
The second harness was the same loop pointed at Hugging Face instead of
TuneChat, using a bearer token and a generated_text response field, with a
10-second retry while a model cold-starts.
Unlike the TuneChat version this one used a normal CORS fetch, so it
could read its responses — that is why the two harnesses behaved so differently in
practice, and why the relay is only needed for the cross-origin case.
index.html loaded <script src="index.js"> — a file that was
never committed to the Space — and imported @xenova/transformers with a bare
module specifier, which no browser can resolve without a bundler or a CDN. So there was no
model, no inference and no progress to report: only the terminal and five progress bars.
Reproducing that faithfully is the honest port; inventing a model would not be.
The five bars are the original's DOM, left at zero because nothing ever drove
them. The original styling (black background, #0f0 monospace, blinking cursor)
is preserved.
“Unlock the power of Artificial General Intelligence with BRUTE-AI!” — the original pitch page, whose real content was a small Flask relay:
It extracts a url GET parameter and forwards the request body to it
unchanged — a server-side relay, which is exactly the missing piece the BRUTE.AI harness
needs to read a cross-origin reply. A static page cannot do this: forwarding a request is
server work, and it is why
brute-suite
holds a CPU slot for it. The page itself was 23 lines of Streamlit wrapping this snippet.
| Space | Original kind | What it actually was | Now |
|---|---|---|---|
| BRUTE-AI | static | client-side self-prompting harness (no-cors fetch) | tab 1 |
| BRUTEAI-PUBLIC | static | same loop against HF Inference | tab 2 |
| BRUTEML | static | terminal UI with a missing index.js | tab 3 |
| REVERSE_PROXY_BRUTE-AI | streamlit | Flask relay + pitch | tab 4 (relay runs in brute-suite) |
None of the four required CPU as published: three were already static and the fourth was a 23-line pitch page around a relay snippet. Serving them as one page frees the three extra Spaces.